Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

cms/templates/assets/footer.mustache

@@ -19,7 +19,7 @@
                     </div>
                     <div class="site-info">
                         <small class="text-muted">
-                            <a href="?guide&lang={{current_lang}}" class="footer-icon guide" title="{{t_guide}}">
+                            <a href="/{{current_lang}}/guide" class="footer-icon guide" title="{{t_guide}}">
                                 <i class="bi bi-book"></i>
                             </a>
                             <span class="ms-1">|</span>